RBI New Rules April 2026: 2FA Mandate, NBFC TDS & Cash Reporting — A Business Guide
RBI April 2026 overhaul: mandatory 2FA on every digital payment, 10% TDS on NBFC interest above ₹10,000, ₹10 lakh PAN reporting on cash, E-mandate Framework 2026, NBFC registration easing. What every Indian business must do this quarter.
- RBI April 2026 overhaul: mandatory 2FA on every digital payment, 10% TDS on NBFC interest above ₹10,000, ₹10 lakh PAN reporting on cash, E-mandate Framework 2026, NBFC registration easing. What every Indian business must do this quarter.
- Use this as a gst & finance updates checklist for rbi new rules april 2026, not as a substitute for checking current official or platform rules.
- Confirm thresholds, filing dates, forms, documents, and portal guidance against the source links before filing, buying software, changing campaigns, or changing a workflow.
April 2026 was the most consequential regulatory month for Indian businesses in recent memory. The RBI enforced mandatory two-factor authentication (2FA/AFA) on every digital payment, the Finance Bill 2026 introduced 10% TDS on NBFC interest payments above ₹10,000, the new Income-tax Act, 2025 imposed a ₹10 lakh PAN reporting trigger on aggregate cash deposits/withdrawals, and the RBI's E-mandate Framework 2026 reshaped how recurring payments are authorised. If your business takes online payments, pays vendor NBFCs, runs payroll, or handles cash — these changes hit your finance stack this quarter. This guide unpacks each rule, the effective date, and the exact action your team must take.
- From 1 April 2026, every UPI, card, wallet, and net-banking transaction needs two-factor authentication. OTP alone is no longer compliant.
- Finance Bill 2026 mandates 10% TDS on interest paid to NBFCs above ₹10,000 per year. Non-deduction disallows 30% of the expense under Section 40(a)(ia).
- ₹10 lakh aggregate cash deposit/withdrawal in a financial year now triggers mandatory PAN reporting to the Income Tax Department.
- TDS on cash withdrawals: 2% above ₹1 crore for filers, 2% above ₹20 lakh + 5% above ₹1 crore for non-filers under Section 194N.
- RBI E-mandate Framework 2026: AFA required at registration. Recurring debits up to ₹15,000 allowed without AFA; ₹1 lakh for insurance, mutual fund SIPs, and credit-card bills.
- Pre-debit notification (24 hours before) and post-debit alert are now legally required for every recurring auto-debit.
- Certain Type 1 NBFCs below ₹1,000 crore asset size are exempt from registration from 1 July 2026 — changes how some vendor financing relationships work.
The 2FA Mandate: Every Digital Payment Now Needs Two Factors
Effective 1 April 2026, the RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 require two independent authentication factors for every customer-initiated digital payment — UPI, debit cards, credit cards, net-banking, and PPI wallets. The framework draws from three identity categories: knowledge (PIN, password), possession (device, token), and inherence (biometric). OTP can still serve as one factor — but never alone. One of the two factors must be uniquely generated per transaction, and the issuer carries full liability for any fraud caused by non-compliance.
What changes for businesses accepting payments
If your business runs a checkout — Shopify, WooCommerce, custom site, payment links — your payment aggregator (Razorpay, Cashfree, PayU, Stripe India) must support AFA across every channel by default. You don't configure 2FA yourself, but you must confirm three things in writing from your PSP:
- The gateway is AFA-compliant for cards, UPI, net-banking, and wallets.
- Your merchant agreement allocates fraud liability correctly (issuer-side after April 2026).
- Checkout-flow abandonment data — RBI's risk-based authentication adds steps for unusual transactions, which can lift drop-off 3-6% on first measurement.
Bulk payments and corporate banking
Corporate treasury teams running bulk payouts via host-to-host integrations, RTGS, NEFT, or UPI corporate must verify their ERP-to-bank pipeline supports AFA at transaction initiation. The most common failure point: legacy SAP/Tally integrations relying on a single API token for batch payments. Talk to your bank's cash-management desk before April closing — non-compliant batches now fail outright rather than process with a warning.
| Payment Channel | Old Standard | New Requirement (April 2026) |
|---|---|---|
| UPI P2P / P2M | UPI PIN only | Device binding + UPI PIN or biometric |
| Card (CNP, domestic) | Card details + OTP | Two independent factors (OTP + biometric / device token) |
| Cross-border CNP cards | Inconsistent | 2FA from 1 October 2026 (BIN registration required) |
| Wallets & PPIs | MPIN | 2FA + risk-based monitoring |
| Recurring debit (e-mandate) | One-time AFA at registration | AFA at registration + 24-hour pre-debit alert |
TDS on NBFC Interest: The Finance Bill 2026 Sting
From April 2026, all corporate borrowers and tax-audited individual borrowers must deduct 10% TDS on interest paid to NBFCs where the annual interest exceeds ₹10,000. This is a major change — previously, interest paid to NBFCs (Bajaj Finance, Tata Capital, Mahindra Finance, L&T Finance) was treated similarly to bank interest under Section 194A, but with a much narrower deduction scope. The Finance Bill 2026 closed that gap. Failure to deduct disallows 30% of the interest expense under Section 40(a)(ia) — a real cost, not a procedural slip.
Worked example: ₹50 lakh working-capital loan from an NBFC
A trading firm with a ₹50 lakh working-capital line at 14% interest pays ₹7 lakh in annual interest. If TDS isn't deducted: the firm loses ₹2.1 lakh as disallowance (30% of ₹7 lakh) when filing ITR, effectively raising the loan's tax-adjusted cost from 14% to ~18.2%. Deduction is straightforward — file Form 26Q quarterly, deposit ₹70,000 by the 7th of the following month, issue Form 16A to the NBFC.
What to do this quarter
- List every NBFC vendor — vehicle finance, equipment finance, working capital, invoice discounting.
- Confirm TAN registration is active and the deductee PAN of each NBFC is on file (most NBFCs publish this).
- Update accounting software (Tally, Zoho Books, Vyapar) to auto-deduct 10% from NBFC interest provisions.
- Schedule Form 26Q upload by the 31st of the month following each quarter end.
Need to automate this end-to-end? Tally/Zoho TDS automation can flag interest-bearing NBFC vendors automatically and generate Form 26Q exports.
₹10 Lakh PAN Reporting on Cash & The New Cash Penalty Regime
The Income-tax Act, 2025 (effective 1 April 2026) tightens the cash transaction reporting net. Aggregate cash deposits or withdrawals of ₹10 lakh or more in a financial year across all bank accounts now mandatorily trigger PAN reporting under the SFT (Statement of Financial Transactions) regime. For property transactions, the threshold is ₹20 lakh. The bank reports — but the onus to reconcile sits with the business.
Section 194N: TDS on cash withdrawal — three tiers
| Filer Status | Withdrawal Bracket | TDS Rate |
|---|---|---|
| Regular ITR filer (last 3 AYs) | Above ₹1 crore in FY | 2% |
| Non-filer | ₹20 lakh – ₹1 crore | 2% |
| Non-filer | Above ₹1 crore | 5% |
For a non-filer business withdrawing ₹1.2 crore in a year, the bank will deduct 2% on ₹20L–₹1cr (₹1.6L) and 5% on the remaining ₹20L (₹1L) — a total ₹2.6L locked up until the next ITR. The fix is mundane but binding: file ITR every year, on time, even if the business has nil tax liability. The 3 prior assessment years are the rolling test.
The cash-payment disallowance, refreshed
Section 40A(3) still disallows cash payments above ₹10,000 per person per day (₹35,000 for transport operators). The 2025 Act preserves this rule with renumbered sections. The practical effect for SMBs with cash-heavy operations — kirana suppliers, daily-wage labour, transport — is that paying anyone more than ₹10,000 in cash in a single day costs you the deduction. Switch to bank transfer or UPI for anything above ₹10,000.
RBI E-mandate Framework 2026: Recurring Payments Reset
On 21 April 2026, the RBI notified the Digital Payments – E-mandate Framework, 2026, consolidating every prior recurring-payment circular into a single rulebook. For any business running subscriptions — SaaS, fitness, OTT, EMIs, insurance — this changes both the mandate UX and the compliance burden. Three rules to internalise:
- AFA at registration is non-negotiable. Modification or withdrawal also needs AFA — no one-click cancel without authentication.
- ₹15,000 frictionless ceiling. Recurring debits up to ₹15,000 per transaction execute without per-transaction AFA. Above ₹15,000, the customer gets a real-time AFA prompt.
- ₹1 lakh carve-out for insurance premiums, mutual-fund SIPs, and credit-card bill payments — these can debit up to ₹1 lakh without per-transaction AFA, reflecting the lower fraud risk of these categories.
The 24-hour pre-debit alert
The issuer must send a pre-transaction notification at least 24 hours before each recurring debit, with full transaction details and a one-tap opt-out. A post-debit confirmation is also mandatory. The auto-replenishment of FASTag and NCMC balances is exempt. For B2C subscription businesses, this notification is now a churn trigger you must plan around — the 24-hour window is effectively a fresh "consider cancelling" prompt every billing cycle.
Subscription business action list
- Audit every recurring SKU — flag those above ₹15,000 to budget for friction.
- Build a value-touch into the 24-hour pre-debit window (delivery confirmation, usage stats, upcoming feature) so the alert lands as confirmation, not as a stop signal.
- Re-mandate customers whose old e-mandates were registered without the new AFA standards by the deadline communicated by your gateway.
NBFC Registration Easing: Effective 1 July 2026
Through directions issued on 29 April 2026, the RBI exempted a class of "Unregistered Type 1 NBFCs" from mandatory registration under Section 45-IA and from the reserve-fund requirement under Section 45-IC, effective 1 July 2026. Eligibility is narrow but useful:
- Asset size below ₹1,000 crore.
- No customer interface.
- No raising of public funds.
Eligible existing NBFCs can apply for deregistration through RBI's PRAVAAH portal by 31 December 2026. For a family-office investment vehicle or a captive financing arm of a larger group, this removes registration overhead. For SMBs borrowing from such entities, due diligence shifts — the lender is no longer RBI-supervised, so loan documentation, KYC, and dispute terms must stand on their own.
Cross-Border Remittances: Easier for Authorised Dealer Banks
The RBI also removed the prior-approval requirement for non-bank entities to form tie-ups with Authorised Dealer (Category I) banks for facilitating outward remittance services. Subject to compliance with non-trade current account remittance directions, fintech players can now plug into AD bank rails without each tie-up being individually approved. For exporters and SaaS companies billing foreign clients, expect faster onboarding to remittance platforms and lower FX spreads as more providers enter the market.
What This All Means: A Sequenced Compliance Plan
Don't try to tackle all of these in one week. The sequence below maps each rule to its hard deadline and the team that owns it:
| Priority | Action | Owner | Deadline |
|---|---|---|---|
| 1 | Get written 2FA-compliance confirmation from payment aggregator | Finance / Tech | Immediate |
| 2 | List NBFC vendors and set up 10% TDS deduction in books | Accounts payable | Before Q1 FY27 close (30 Jun 2026) |
| 3 | Audit cash ledger — flag any single-day cash payments above ₹10,000 | Accounts payable | Monthly close |
| 4 | Update bulk-payment APIs/treasury workflows for AFA | Treasury / IT | Before next batch payout |
| 5 | Update subscription product flows around 24-hour pre-debit alerts | Product | Before next renewal cycle |
| 6 | Verify ITR filed on time for last 3 AYs to avoid 194N higher TDS | Tax / CFO | 31 Jul 2026 (FY 25-26) |
How Bizeract Can Help
Most of these changes are operational — they break when a vendor master is wrong, a TDS code is missing, or an integration isn't tested. We work with growing businesses on:
- Automating TDS deduction at the vendor-bill stage so NBFC interest never escapes the 10% cut.
- Quarterly TDS return filing (Form 26Q) and Form 16A issuance to NBFC vendors.
- GST and tax registration for new entities that need to onboard AFA-compliant payment rails.
- Subscription retention workflows built around the new 24-hour pre-debit notification window.
Frequently Asked Questions
Q: Is OTP still allowed for digital payments after April 2026?
Yes, but only as one of two factors. OTP alone — without a second independent factor like a device binding, biometric, or PIN — is no longer compliant. Banks and payment platforms have moved to OTP-plus-biometric or device-plus-PIN combinations to satisfy the AFA standard.
Q: Does the 10% TDS on NBFC interest apply to small proprietorships?
Only if the proprietorship was subject to tax audit in the preceding financial year (turnover above ₹1 crore for business or ₹50 lakh for profession). Non-audit individuals and HUFs are outside the TDS net for NBFC interest, but other Section 194A rules still apply.
Q: What happens if I forget to deduct TDS on NBFC interest?
Two consequences. First, 30% of the interest expense is disallowed under Section 40(a)(ia), raising your taxable profit. Second, interest at 1% per month on the un-deducted amount under Section 201 applies until paid. The disallowance is the bigger hit — for a ₹10 lakh annual NBFC interest, forgetting TDS costs ₹3 lakh in additional tax base.
Q: Do recurring SIPs above ₹15,000 still work without per-transaction AFA?
Yes. Mutual fund SIPs, insurance premiums, and credit-card bill payments enjoy a higher ₹1 lakh ceiling without per-transaction AFA — recognising their lower fraud profile. The one-time AFA at mandate registration is still required.
Q: My business deposits ₹2 lakh in cash weekly. Am I caught by the ₹10 lakh PAN rule?
Yes. The rule is on aggregate cash deposits or withdrawals across all your accounts in a financial year. ₹2 lakh weekly crosses ₹10 lakh in five weeks. The bank reports the SFT entry to the IT department; you must ensure the deposits reconcile to declared business turnover in your books and GSTR-1/3B. Mismatches are the most common trigger for IT scrutiny notices.
Q: I borrow from a friend's NBFC. Will it still be RBI-supervised after July 2026?
Only if it exceeds ₹1,000 crore asset size, has a customer interface, or raises public funds. Smaller family-office or group-captive NBFCs can deregister. Practical impact: tighten your loan agreement yourself — interest rate, repayment schedule, dispute resolution — since RBI's fair-practices code may no longer apply to your lender.
Q: Do these rules affect FY 2025-26 ITR filing (due July 2026)?
No. The new TDS rules, AFA mandate, and PAN reporting changes apply prospectively from 1 April 2026 onwards. FY 2025-26 ITR (filed July 2026) follows the existing rules under the 1961 Income-tax Act. The new rules are first reflected in advance-tax instalments and TDS deductions for tax year 2026-27.
The Bottom Line
April-May 2026 isn't a routine compliance cycle. The 2FA mandate, NBFC TDS, cash-reporting thresholds, and e-mandate framework collectively reshape how money moves into, out of, and inside Indian businesses. Each rule has a narrow, fixable break point — a missing TAN, an un-deducted invoice, a legacy payment API. Fix them sequentially before the first quarterly close under the new regime and the rest of FY 2026-27 runs clean. Skip them, and the first SFT notice or 40(a)(ia) disallowance will cost more than the work would have.
Sources: RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025; RBI Digital Payments — E-mandate Framework, 2026 (21 April 2026); Finance Bill 2026; Income-tax Act, 2025; CBIC SFT notifications; RBI NBFC Directions (29 April 2026); CAclubindia, India Briefing, Business Standard May 2026 coverage.
What should you verify before using this GST & Finance Updates guide?
Before acting on rbi new rules april 2026, verify the current rules or platform behavior with the GST Portal. The practical answer depends on your business model, state, turnover, documents, software stack, and whether the decision affects tax, customer data, paid media spend, or a production workflow.
Use this article as a working checklist, then confirm thresholds, registration status, return forms, document rules, and portal notices. In our audits, most expensive mistakes do not come from ignoring the whole process. They come from one stale assumption, one mismatched address, one missing event, or one automation path that nobody tested after launch.
| Checkpoint | Why it matters | Where to confirm |
|---|---|---|
| Current rule or platform status | Limits, forms, policies, and APIs can change after a blog update. | GST Portal |
| Your exact business case | A local shop, freelancer, D2C store, agency, and SaaS team rarely need the same next step. | Documents, invoices, campaign data, analytics setup, or workflow logs |
| Implementation evidence | The safest GST decision is backed by proof, not memory or screenshots from an old setup. | Portal acknowledgement, dashboard export, invoice sample, test lead, or error log |
How do we apply this in real business work?
We start with the smallest decision that can be verified. For compliance work, that means matching PAN, address, bank, invoices, and portal status before filing. For websites, marketing, analytics, and automation, it means testing the real user path from first click to final record. The boring checks catch the costly failures.
A useful rule: if a claim changes money, tax, reporting, or customer communication, keep evidence for it. Save the acknowledgement, export the report, test the form, and note the date you verified the source. That gives you a clean trail when a client, officer, platform, or internal team asks why the setup was done that way.
When should you get expert review?
Get expert review when the next action can create tax exposure, lost reporting data, ad waste, broken customer communication, or production downtime. A simple self-check is enough for low-risk learning. A filed return, new registration, tracking migration, paid campaign restructure, or live automation deserves a second set of eyes before it affects customers or records.
How often should this be rechecked?
Recheck the decision whenever your turnover, state, product mix, campaign budget, website stack, analytics property, or workflow ownership changes. Also recheck it after major portal updates, platform policy changes, annual filing deadlines, and vendor migrations. The guide is useful today only if the facts behind it still match your business.
What is the fastest safe way to decide?
Write the decision in one sentence, list the proof needed for that sentence, and verify only those items first. This keeps the work focused. If the proof confirms the decision, proceed. If one item is unclear, pause and resolve that point before changing filings, campaigns, tracking, website code, or automation logic.
What can go wrong if you skip verification?
The usual failure is not dramatic at first. It looks like a rejected application, a wrong tax invoice, a missing conversion, a duplicate lead, a broken report, or a workflow that silently stops. Those small failures become expensive when nobody notices them until month-end reporting, filing day, or a customer escalation.
What evidence should you keep after making the change?
Keep enough evidence to reconstruct the decision later. For a compliance topic, that usually means the application reference number, registration certificate, invoice sample, return acknowledgement, payment challan, notice reply, or source link checked on the day of filing. For a website, campaign, analytics setup, or automation, keep the before-and-after screenshot, test submission, dashboard export, webhook log, and the exact setting that changed.
This matters because most business fixes are revisited months later, when nobody remembers the original reason. A short evidence trail makes audits faster, handovers cleaner, and vendor conversations more precise. It also keeps the advice in this guide tied to your real operating context instead of becoming a generic checklist that gets copied without review.
- Date checked: record when the official source, dashboard, or portal screen was reviewed.
- Business context: note the entity, state, product, campaign, property, or workflow affected.
- Proof of action: save the acknowledgement, report export, test result, or live URL.
- Owner: assign one person to re-check the item when rules, tools, or business volume change.
Which next step should you take after reading this?
Turn the article into one action list. Mark what is already true, what needs proof, and what needs expert review. If you want to go deeper, compare this guide with GST & Finance India: Latest Changes, Timelines and Due Dates (May 2026), RBI Rate Cut 2025: What It Means for Your Home Loan EMI, FDs, and SCSS Returns, and India Tax Compliance Calendar 2026: GST, TDS, ITR & Advance Tax Due Dates. Then update the decision only after the official source and your own records agree.
Frequently asked questions
Is OTP still allowed for digital payments after April 2026?
Yes, but only as one of two factors. OTP alone — without a second independent factor like device binding, biometric, or PIN — is no longer compliant under the RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025, effective 1 April 2026. Banks have moved to OTP-plus-biometric or device-plus-PIN combinations.
When did 10% TDS on NBFC interest become mandatory?
From April 2026 under the Finance Bill 2026. Corporate borrowers and tax-audited individual borrowers must deduct 10% TDS on interest paid to NBFCs where the annual interest exceeds ₹10,000. Non-deduction triggers 30% disallowance of the interest expense under Section 40(a)(ia) of the Income-tax Act.
What is the new ₹10 lakh cash deposit rule from 1 April 2026?
The Income-tax Act, 2025 mandates PAN reporting under the Statement of Financial Transactions (SFT) regime for aggregate cash deposits or withdrawals of ₹10 lakh or more in a financial year across all bank accounts. For property transactions, the threshold is ₹20 lakh. Banks file the report; businesses must reconcile to declared turnover.
What is the AFA-free limit under the RBI E-mandate Framework 2026?
Recurring debits up to ₹15,000 per transaction execute without per-transaction Additional Factor Authentication. A higher ₹1 lakh ceiling applies to insurance premiums, mutual fund SIPs, and credit-card bill payments. The framework was notified on 21 April 2026 and is effective immediately for all payment system providers.
What is Section 194N TDS on cash withdrawal?
Section 194N applies three tiers: 2% TDS on withdrawals above ₹1 crore in a financial year for regular ITR filers; 2% on withdrawals between ₹20 lakh and ₹1 crore for non-filers; 5% on withdrawals above ₹1 crore for non-filers. The "regular filer" test is ITR filed in each of the last 3 assessment years.
Which NBFCs are exempt from RBI registration from 1 July 2026?
RBI directions issued 29 April 2026 exempt "Unregistered Type 1 NBFCs" from Section 45-IA registration and Section 45-IC reserve fund requirements if they have asset size below ₹1,000 crore, no customer interface, and do not raise public funds. Eligible existing NBFCs may deregister via the PRAVAAH portal by 31 December 2026.
Let's talk about your business.
Tell us what you're working on and where you want to go. We'll put together a plan. No obligation, no sales pitch.
- Free 30-minute call
- A plan built around your goals
- No obligation, no pressure
- Your own account manager